﻿using System;
using System.Collections.Generic;

namespace Confessor
{
    static class BuildConfessorScript
    {
        static public void CreateConfessorScript(System.Windows.Forms.TreeView treeview, ScanObject scanObject)
        {
            // Set up the FileAction's class so we can utilize it's methods.
            XFileActions xFA = new XFileActions();

            // List to hold the items which will be written into our script.
            List<string> confessorScript = new List<string>();

            #region Default Confessor CMD's
            //The following are entered into every Confess.bat batch file.
            if (scanObject.InvestigationName != string.Empty)
            {
                confessorScript.Add(@"ECHO Investigation Name: " + scanObject.InvestigationName);
            }
            confessorScript.Add(@"ECHO Investigation ID: " + scanObject.InvestigationID);
            confessorScript.Add(@"ECHO Tool Share > %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO %1 >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO Results Share >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO %2 >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO Whoami results >> %2\CONFESSOR.log");
            confessorScript.Add(@"whoami >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO Time information from the Network and target computer %COMPUTERNAME%. >> %2\CONFESSOR.log");
            confessorScript.Add(@"net time >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> %2\CONFESSOR.log");
            confessorScript.Add(@"%1\now.exe >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> %2\CONFESSOR.log");
            confessorScript.Add(@"Echo Operating System Version >> %2\CONFESSOR.log");
            confessorScript.Add(@"ver.exe >> %2\CONFESSOR.log");
            confessorScript.Add(@"ECHO. >> %2\CONFESSOR.log");
            #endregion

            //Prepare to write additional items to run based of of treeview checkbox decisions.
            #region Network Stack
            //Network Stack
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[0].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running IPconfig /all on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"ipconfig /all > %2\ipconfig.log 2>> %2\error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[1].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running arp -a on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"arp -a > %2\arp.log 2>> %2\error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[2].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running netstat -abno on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"netstat -abno > %2\netstat.log 2>> %2\error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[3].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running nbtstat -c on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"nbtstat -c >> %2\nbtstat.log 2>> %2\error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[4].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running nbtstat -S on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"nbtstat -S >> %2\nbtstat.log 2>> %2\error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[5].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\TCPView /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running tcpvcon -a on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\tcpvcon.exe -a > %2\tcpvcon.log 2>> %2\error.log");
            }
            if (treeview.Nodes[0].Checked || treeview.Nodes[0].Nodes[6].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running openports on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\openports.exe > %2\openports.log 2>> %2\error.log");
            }
            #endregion

            #region Volatile Information
            // Volatile Information
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[0].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsInfo /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running PSInfo.exe -d -s on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\psinfo.exe -d -s > %2\PSInfo.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[1].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running srvinfo.exe -s on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\srvinfo.exe -s > %2\server.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[2].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running srvinfo.exe -d on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\srvinfo.exe -d > %2\server.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[3].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running Systeminfo on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"Systeminfo.exe > %2\systeminfo.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[4].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net use on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net use > %2\net_use.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[5].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net view on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net view %COMPUTERNAME% > %2\net_view.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[6].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net share on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net share > %2\net_share.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[7].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net session on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net session > %2\net_session.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[8].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net file on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net file > %2\net_file.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[9].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsList /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running PSList.exe -mx/-t on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\PSList.exe -mx > %2\pstasklist.log 2>> %2\error.log");
                confessorScript.Add(@"%1\PSList.exe -t >> %2\pstasklist.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[10].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running tasklist /svc /fo csv on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"tasklist /svc /fo csv > %2\tasklist.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[11].Checked)
            {
                confessorScript.Add(@"now.exe [Running tlist.exe -t/-c/-s on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"tlist.exe -t > %2\tlist.log 2>> %2\error.log");
                confessorScript.Add(@"tlist.exe -c >> %2\tlist.log 2>> %2\error.log");
                confessorScript.Add(@"tlist.exe -s >> %2\tlist.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[12].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\ListDLLs /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running listdlls.exe on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\listdlls.exe > %2\listdlls.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[13].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\Handle /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running handle.exe -au on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\handle.exe -au > %2\handles.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[14].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running openfiles /query on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\openfiles.exe /query /fo csv > %2\openfiles.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[15].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsService /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running PSservice.exe on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\PSservice.exe > %2\services.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[16].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running driverquery on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\driverquery.exe /fo csv /si > %2\driverquery.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[17].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running sc.exe /query on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"sc.exe query > %2\SC_Query.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[18].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\psfile /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running PSFile.exe on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\PSFile.exe > %2\PSfiles.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[19].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running at.exe on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"at.exe > %2\at.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[20].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running set on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"set > %2\set.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[21].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running ftype on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"ftype > %2\ftype.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[22].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running assoc on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"assoc > %2\assoc.log 2>> %2\error.log");
            }
            if (treeview.Nodes[1].Checked || treeview.Nodes[1].Nodes[23].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running showacls on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\showacls.exe > %2\showacls.log 2>> %2\error.log");
            }
            #endregion

            #region Account and User Information
            //Account and User Information
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[0].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\LogonSessions /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running logonsessions.exe -p on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\LogonSessions.exe -p > %2\logonsessions.log 2>> %2\error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[1].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\psloggedon /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running psloggedon.exe on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\psloggedon.exe > %2\Psloggedon.log 2>> %2\error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[2].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net localgroup administrators on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net localgroup administrators > %2\admin_accounts.log 2>> %2\error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[3].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running net user on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"net user > %2\net_user.log 2>> %2\error.log");
            }
            if (treeview.Nodes[2].Checked || treeview.Nodes[2].Nodes[4].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running showpriv (for Win2k3) on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\showpriv.exe SeLockMemoryPrivilege > %2\showpriv.log 2>> %2\error.log");
                confessorScript.Add(@"%1\showpriv.exe SeSecurityPrivilege >> %2\showpriv.log 2>> %2\error.log");
                confessorScript.Add(@"%1\showpriv.exe SeTakeOwnershipPrivilege >> %2\showpriv.log 2>> %2\error.log");
            }
            #endregion

            #region Compromised Code
            //Compromised Code
            if (treeview.Nodes[3].Checked || treeview.Nodes[3].Nodes[0].Checked)
            {
                confessorScript.Add(@"REM   REG ADD HKCU\Software\Sysinternals\SigCheck /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"REM	now.exe [Running sigcheck.exe on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"REM	sigcheck.exe -e -i -s -u C:\ > %2\sigcheck.log 2>> %2\error.log");
            }
            if (treeview.Nodes[3].Checked || treeview.Nodes[3].Nodes[1].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\AutoRuns /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running autorunsc.exe -a -v on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\autorunsc.exe -a -v > %2\autorunsc.log 2>> %2\error.log");
            }
            if (treeview.Nodes[3].Checked || treeview.Nodes[3].Nodes[2].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running doskey /history on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"doskey /history > %2\doskey.log 2>> %2\error.log");
            }
            #endregion

            #region Event Logs
            //Event Logs
            if (treeview.Nodes[4].Checked || treeview.Nodes[4].Nodes[0].Checked)
            {
                confessorScript.Add(@"REG ADD HKCU\Software\Sysinternals\PsLoglist /v EulaAccepted /t REG_DWORD /d 1 /f");
                confessorScript.Add(@"%1\now.exe [Running psloglist for Security events on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\psloglist.exe -s -t \t security > %2\psloglistSECURITY.log 2>> %2\error.log");
            }
            if (treeview.Nodes[4].Checked || treeview.Nodes[4].Nodes[1].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running psloglist for Security events on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\psloglist.exe -s -t \t application > %2\psloglistAPPLICATION.log 2>> %2\error.log");
            }
            if (treeview.Nodes[4].Checked || treeview.Nodes[4].Nodes[2].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running psloglist for System events on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\psloglist.exe -s -t \t system > %2\psloglistSYSTEM.log 2>> %2\error.log");
            }
            #endregion

            #region MAC Times
            // Modified Accessed and Changed Times
            if (treeview.Nodes[5].Checked || treeview.Nodes[5].Nodes[0].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running file MODIFY time check on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"dir /t:w /o:d /a /s C:\ > %2\MODIFYtime_Mac.log 2>> %2\error.log");
            }
            if (treeview.Nodes[5].Checked || treeview.Nodes[5].Nodes[1].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running file ACCESS time check on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"dir /t:a /o:d /a /s C:\ > %2\ACCESStime_mAc.log 2>> %2\error.log");
            }
            if (treeview.Nodes[5].Checked || treeview.Nodes[5].Nodes[2].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running file CREATE time check on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"dir /t:c /o:d /a /s C:\ > %2\CREATEtime_maC.log 2>> %2\error.log");
            }
            #endregion

            #region SecCheck
            // SecCheck.exe (Not good for 2k8 hosts
            if (treeview.Nodes[6].Checked)
            {
                confessorScript.Add(@"%1\now.exe [Running seccheck on %COMPUTERNAME%.] >> %2\CONFESSOR.log");
                confessorScript.Add(@"%1\seccheck.exe > %2\seccheck.log 2>> %2\error.log");
            }
            #endregion

            #region User Defined Runtimes / RegKey / Process Starts
            // User Defined Data
            //...to be implemented next version.
            #endregion

            #region Confessor End Script ~FIN
            confessorScript.Add(@"%1\now.exe [Confessor script finished.] >> %2\CONFESSOR.log");
            confessorScript.Add(@"Echo Finished >> %2\_finished.txt");
            #endregion

            // Write the script through the FileAction Class
            xFA.WriteConfessorScript(confessorScript, scanObject);
        }
    }
}
